CVE-2021-42556: Rasa X

Medium severity, CVSS 5.5. EPSS: 1% chance of exploitation in the next 30 days.

Rasa X before 0.42.4 allows Directory Traversal during archive extraction. In the functionality that allows a user to load a trained model archive, an attacker has arbitrary write capability within specific directories via a crafted archive file.

Affected products

• Rasa Rasa X: before 0.42.4 (fixed in 0.42.4)

Published 2021-10-22. Last modified 2026-06-17.